Introduction

In the world of distributed caching, securing your cache nodes is paramount to protect your data and infrastructure from potential threats. NCache, a powerful distributed caching solution, provides robust security features for managing cache nodes effectively. This article will walk you through the process of configuring different levels of security in NCache to ensure the safety and integrity of your cached data.

Note: All these features are available only with NCache Enterprise Edition.

Install and Set Up NCache

Before you can configure node security, ensure that you have NCache installed and set up on your servers. You can download and install NCache from the official NCache website (https://www.alachisoft.com/download-ncache.html) if you haven't already.

Configuring SSL/TLS Encryption in Windows


What is SSL/TLS Encryption?

SSL/TLS encryption plays a crucial role in ensuring robust security for applications or websites that handle sensitive operations, such as online financial transactions, login password entry and so on. In these scenarios, SSL/TLS facilitates secure communication exclusively between the involved parties by safeguarding the confidentiality and integrity of shared information.

For communication between the server and the client through SSL/TLS handshake, a certificate is essential. This certificate, acting as an entity, contains the necessary information to encrypt data exchanged between both parties. It incorporates a shared public key that, upon successful matching during the connection establishment, enables secure communication between the server and the client. The below image will give you a complete idea about the data communication between client and server with SSL/TLS encryption.

Data Encryption

Communication between Server and Client with SSL/TLS Encryption

NCache with SSL/TLS Encryption

To prepare for issuing an SSL certificate in NCache, it's important to take the following prerequisites into account:

Ensure that the certificate includes a private key. You can find guidance on creating such certificates in this blog post titled "Generating Self-Signed Certificates on Windows."

Note: Self-signed certificate should be used only for testing or proof of concept. Highly not recommended for the production use

Make sure that the private key is set as exportable, allowing it to be exported to all nodes, including the client machine.

Import the certificate to the machine, click here for the details

Prerequisites before enabling SSL security

Get the Thumbprint and Certificate Name from MMC

Enabling TLS/SSL Certificate – Windows

Enabling TLS/SSL Certificate - Windows

You can activate the certificate for NCache by accessing the Registry Editor or you can use below PowerShell script

Enable-NCacheTLS -Node "10.0.0.220" -CertificateName "company.co.nz" -CertificateThumbprint "01bd1e9f8ea60c…………" -ClientServerCommunication -BridgeCommunication -UseMutualTLSForClientToServer true

Enable TLS on Client-to-Server Communication

Enable TLS on Client-to-Server Communication

Enable TLS on Bridge Cache

Note:

Enable TLS on Server-to-Server Communication

TLS on Client Machines

<tls-info>
    <certificate-name>certificate-name</certificate-name>
    <certificate-thumbprint>your-thumbprint</certificate-thumbprint>
    <enable>false</enable>
    <enable-client-server-tls>false</enable-client-server-tls>
    <use-mutual-tls-for-client-to-server>false</use-mutual-tls-for-client-to-server>
</tls-info>

<enable-client-server-tls> and <use-mutual-tls-for-client-to-server> will work only if <enable> is set to true.

To confirm that the client connectivity over TLS is functioning correctly, you can execute the Test-Stress cmdlet using the Windows PowerShell Tool. Below is an example of running Test-Stress on the cache with the name "demoCache."

Test-Stress -CacheName demoCache

Stress test from NCache web manager

Configure TLS Encryption – Linux

Configure TLS Encryption - Linux

  1. Log in to your system using the designated NCache user.
  2. Verify whether the NCache Service is active and running under the NCache user on Linux. Note that, by default, this user does not possess a home directory, which is essential. To establish the required home directory, execute the following commands.

    sudo mkdir /home/ncache

    sudo chown ncache /home/ncache

  3. Once you have set up your home directory, proceed to install the certificates on your Linux machine. Utilize the provided PowerShell commands to generate a store object named Root and subsequently install the SSL/TLS certificate RootCA.pfx into that store. 
    $store=[System.Security.Cryptography.X509Certificates.X509Store]::new([System.Security.Cryptography.X509Certificates.StoreName]::Root,[System.Security.Cryptography.X509Certificates.StoreLocation]::CurrentUser,[System.Security.Cryptography.X509Certificates.OpenFlags]::ReadWrite)

$store.Add([System.Security.Cryptography.X509Certificates.X509Certificate2]::new("RootCA.pfx","password",[System.Security.Cryptography.X509Certificates.X509KeyStorageFlags]::PersistKeySet))

  4. The configuration settings for certificates are stored in the tls.ncconf file, located at %NCHOME/config. Below is an example of a sample configuration
<tls-info>
    <certificate-name>certificate-name</certificate-name>
    <certificate-thumbprint>your-thumbprint</certificate-thumbprint>
    <enabled>False</enabled>
    <require-client-certificate>False</require-client-certificate>
</tls-info>

All these parameter setups are discussed above on TLS Encryption configuration with windows.

After completing the configuration restart the cache and client process and the NCache service

Note: Make sure that NCache service is running under the same user which was used to import the certificate.

3. Security Cache Server Nodes

NCache's Secured Cache Server Node is a fundamental component of its caching architecture, engineered with a primary focus on enhancing data security.

NCache, a distributed in-memory cache, offers security features to safeguard cache and node operations, enhancing the overall security of your working environment. While security is an optional aspect, it becomes imperative, especially when there is open user access to your cache.

The two primary processes involved in the security are

  1. Authentication and
  2. Authorization

The Secured Cache Server Node incorporates robust access control and authentication mechanisms. Only authorized users, applications, or services are granted access to the cache server node. This ensures that data can only be accessed by trusted entities, significantly reducing the risk of unauthorized access and potential data breaches.

NCache Server Side security architecture

NCache Server Side security architecture


Authentication

Authentication verifies whether the client attempting to connect to the cache is a legitimate user within your domain. NCache achieves this by utilizing LDAP Service Providers to authenticate all incoming client connection requests.

In terms of Cache Level Security, you are required to furnish an LDAP provider against which all client connections undergo authentication. It is essential to ensure that for each node, you provide the identical LDAP provider, assuming a homogeneous working environment. This practice is implemented to maintain uniformity among administrators across all nodes.

Authorization

Upon successful authentication, it is established that a particular user is a valid user within that domain. However, the determination of whether that user possesses the privileges to execute operations on the cache cluster or a server node is addressed through authorization. Authorization is the process of specifying the actions or scope that the authenticated user is permitted to perform on your cache or node. If a user is registered against a cache or node, they are granted the authority to execute all API or managerial operations on the respective cache or node.

There are multiple ways you can setup the Node level security for a NCache. Let’s see how to setup using,

  1. NCache web manager and
  2. PowerShell

1. Using NCache Web Manager

Before getting into node level security, you should configure NCache Manager Setting

NCache Manager Setting

Click on server settings and configure the manager security as shown in above figure.

Node level security allows you to specify administrators who can perform managerial operations like Create cache, start cache etc.

Under select user section select the user

From the setting screen, select Node Level Security,

Step 1. Verify the server node IP. Enter the server node IP / Name and click on verify button.

Step 2. Once the server node verified, select the user from the select user section where the select user can perform the managerial operations like create cache, start, stop cache and so on.

Note: Check the box enable security

Step 3. Finally, click on Apply to save the changes. It also update the changes in security.nconfig file under <administrators> tag.

2. Using PowerShell

Using Add-NodeSecurity command, we can configure Node level security for the cache.

Add-NodeSecurity -EnableSecurity -AdminUserID youradminuserId -AdminPassword mypassword -PrimaryLdap yourprimarydomain -PrimaryLdapPort 389 -NodeName yourNodeAddress

The above command will enable securirty on your node address, and assign the user as administrator where the primary LDAP controller is yourprimarydomain

Note: You must make sure at least one user in the node’s admin list before you enable the security for the first time using this command.

Admin credential must be either a local admin or node admin credentials.

If you want to add more users, use the following command after step 1. The following command adds the user david_jones to the secured users list of the node 20.200.20.38 with yourprimarydomain as the primary domain controller.

Add-NodeSecurity -AddUser -AdminUserID Kriish_Mahendran -AdminPassword mypassword -NewUser David_Warner -NewUserPassword userpassword -NewUserDN "CN=David Warner, OU=admin, DC=yourdomain, DC=org" -PrimaryLdap yourprimarydomain -PrimaryLdapPort 389 -NodeName 20.200.20.38

4. Data Encryption

NCache guarantees that data remains securely encrypted while residing in storage on cache servers. This security measure ensures that even if an unauthorized entity gains physical access to the cache server's storage, the data remains incomprehensible and well-protected. The management of encryption keys is executed with strict security protocols to block any unauthorized attempts at decryption.

Encryption and decryption of NCache data take place within the NCache client application process. Consequently, all data transmitted over the network between your application and the cache cluster is already encrypted. Additionally, solely encrypted data is stored in the cache store. An encryption key, provided by you, is utilized by NCache and securely stored in an encrypted manner within NCache security configuration files on each cache server. Upon a successful connection, the encryption key is automatically transmitted to clients for in-memory use.

Enabling encryption through the NCache web manager requires no programming effort on your part. Once encryption is activated, the NCache client seamlessly initiates the encryption of your objects before transmitting them to the cache cluster. Likewise, it automatically decrypts objects retrieved from the cache before delivering them to your application.

Encryption can be enabled in the following steps:

The supported flavors of AES (Advanced Encryption Standard) and 3DES ( Triple-DES ) Encryption are listed below

Input the encryption key into the Key text box. This key should consist of 32 characters and is designed for use with a 256-bit encryption algorithm.

Select the "Save Changes" option to implement this configuration for the cache.

Encryption can also be enabled at the time of cache creation.

The encrypted objects will automatically be decrypted by the NCache client before sending them to the application.

Summary

These security features collectively create a robust shield around NCahce, making it a dependable choice for organizations handling sensitive data.